CVE-2015-8476

Name	CVE-2015-8476
Description	Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-2012-0796.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-363-1, DSA-3416-1
Debian Bugs	807265

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libphp-phpmailer (PTS)	bullseye	6.2.0-2	fixed
	bookworm	6.6.3-1	fixed
	sid, trixie	6.9.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
libphp-phpmailer	source	squeeze	5.1-1+deb6u11	DLA-363-1
libphp-phpmailer	source	wheezy	5.1-1.1	DSA-3416-1
libphp-phpmailer	source	jessie	5.2.9+dfsg-2+deb8u1	DSA-3416-1
libphp-phpmailer	source	(unstable)	5.2.14+dfsg-1		807265

https://github.com/PHPMailer/PHPMailer/commit/6687a96a18b8f12148881e4ddde795ae477284b0 (v5.2.14)